Overview

overview

10

Static

static

10

2024-08-08...de.exe

windows7-x64

9

2024-08-08...de.exe

windows10-2004-x64

9

Resubmissions

08/08/2024, 04:49

240808-ff4nzazcmj 10

08/08/2024, 04:41

240808-fbj4rstbqd 10

Analysis

  • max time kernel
    434s
  • max time network
    494s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/08/2024, 04:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-08-08_3d293b21be3c8ebb13ca2d4738835a0e_darkside.exe

  • Size

    146KB

  • MD5

    3d293b21be3c8ebb13ca2d4738835a0e

  • SHA1

    9bd5479d5c285f78fbd5ad55a227001656aa837b

  • SHA256

    98d7ec465a754cac49376ce4bc934eef2fc483d789b582d361ba0bd32c623a7b

  • SHA512

    50d15048238029d199f9f9559cccc608bef39e71e487122ff714d4a2ee88af540bef4c798fc86264ea44b2211f7d3168b13fedb05d1faab95594892c3a974a3f

  • SSDEEP

    3072:6qJogYkcSNm9V7Dvts3Kr7ZsPDzFY0mT:6q2kc4m9tDVs62PHF

Score
9/10
discoveryransomwarespywarestealer

Malware Config

Signatures

  • Renames multiple (597) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-08-08_3d293b21be3c8ebb13ca2d4738835a0e_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-08-08_3d293b21be3c8ebb13ca2d4738835a0e_darkside.exe"
    1⤵
    • Drops desktop.ini file(s)
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1472
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:2656
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\LfGMl9Wku.README.txt
      1⤵
      • Opens file in notepad (likely ransom note)
      PID:2652

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\IIIIIIIIIII
            Filesize

            129B

            MD5

            899f892a47397c1acfc46632410129ec

            SHA1

            fddb76c212bdad4675d893288fac4a1273d732fd

            SHA256

            c76406d4bd587fc89eed126fe8a14b855a3e772a468517378b1dd0801556cd2f

            SHA512

            e557cee9c6470b315ebaa86b6ff932a583b1285fb6b867b03f518d7e3d50a6f43b6c44f8f813cce8262446b127153312d9ce0eed049cdd9e0a990e5aec5039b7

            Download Submit

          • C:\LfGMl9Wku.README.txt
            Filesize

            957B

            MD5

            4d014abc75ecaeab62560e89588a36de

            SHA1

            9effd329081e13e9172dc7e6fe76af675d9789c5

            SHA256

            1f7611e25be229a74b73b8d6eb9d6bc171d27c3d42d6e2539f635ba3f47389e2

            SHA512

            844bda5d9d674685a40cdec6c7900c7235f56fe12bd069e1b6ea9d0de96bafd8dba8377b800b28c9b4e2afdec233e42004c2ef264993b6fa0236b1b4ccbdbcbd

            Download Submit

          • F:\$RECYCLE.BIN\S-1-5-21-786284298-625481688-3210388970-1000\DDDDDDDDDDD
            Filesize

            129B

            MD5

            b2485bc2cb0dae6286380ecdd758a2a0

            SHA1

            d62e5c3ccff4dfd513e4af43150d0c615383f733

            SHA256

            82e267aaed924e1a2683b330a60723d5f4da37fc96947e67b9c69c4b7907656d

            SHA512

            00f9cc2ef7d1044e3ac4a2599c68a6420ccc282f2d4cb4d45311d4642bdc69d582540c62a7c22c2cb0b7bfc21618116e178516fd74f7353ea735a937aeb5d439

            Download Submit

          • memory/1472-0-0x0000000002C10000-0x0000000002C20000-memory.dmp

            Filesize

            64KB

            Download

          • memory/1472-2-0x0000000002C10000-0x0000000002C20000-memory.dmp

            Filesize

            64KB

            Download

          • memory/1472-1-0x0000000002C10000-0x0000000002C20000-memory.dmp

            Filesize

            64KB

            Download